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Foreword 

This Technical Specification (TS) has been produced by ETSI 3rd Generation Partnership Project (3GPP). 

The present document may refer to technical specifications or reports using their 3GPP identities, UMTS identities or 
GSM identities. These should be interpreted as being references to the corresponding ETSI deliverables. 

The cross reference between GSM, UMTS, 3GPP and ETSI identities can be found under 
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Foreword 



rd , 



This Technical Specification has been produced by the 3 Generation Partnership Project (3GPP). 

The contents of the present document are subject to continuing work within the TSG and may change following formal 
TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an 
identifying change of release date and an increase in version number as follows: 

Version x.y.z 

where: 

X the first digit: 

1 presented to TSG for information; 

2 presented to TSG for approval; 

3 or greater indicates TSG approved document under change control. 

y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, 
updates, etc. 

z the third digit is incremented when editorial only changes have been incorporated in the document. 
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Scope 



This Technical Specification specifies the stage 2 description of the Fraud Information Gathering System (FIGS) feature 
which provides the means for the HPLMN to monitor the activities of its subscribers in a VPLMN. 

Three levels of FIGS service are defined, levels 1 to 3. 

Level 1 will use the facilities provided by Transferred Account Procedure (TAP). 

Levels 2 and 3 will use facilities provided by Customised Applications for Mobile network Enhanced Logic (CAMEL), 
in particular, the information flows between the GSM Service Switching Function (gsmSSF) and GSM Service Control 
Function (gsmSCF). Phase 1 and Phase 2 CAMEL facilities will be used. 

Connection-orientated services only are covered. 



Normative references 



The following documents contain provisions which, through reference in this text, constitute provisions of the present 
document. 

• References are either specific (identified by date of publication, edition number, version number, etc.) or 
non-specific. 

• For a specific reference, subsequent revisions do not apply. 

• For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including 
a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same 
Release as the present document. 

[1] GSM 01.04: "Digital cellular telecommunications system (Phase 2+); Abbreviations and 

acronyms". 

[2] 3GPP TS 42.031: 'Digital cellular telecommunications system (Phase 2+); Fraud Information 

Gathering System (FIGS) - Stage 1". 

[3] GSM 03.78: 'Digital cellular telecommunications system (Phase 2+); Customised Application for 

Mobile network Enhanced Logic (CAMEL Phase 1)' - stage 2; version S.x.y". (GSM Release 96) 

[4] GSM 03.78: 'Digital cellular telecommunications system (Phase 2+); Customised Application for 

Mobile network Enhanced Logic (CAMEL Phase 2) - stage 2; version 6.x.y". (GSM Release 97) 

NOTE: [3] specifies CAMEL Phase 1 functionality, [4] specifies CAMEL Phase 2 functionality. 



3 Definitions and abbreviations 

3.1 Definitions 

For the purposes of this specification the following definitions apply: 

A subscriber: The calling mobile subscriber. 

B subscriber: The mobile subscriber originally called by the A subscriber. 

C subscriber: The subscriber to whom the B subscriber has requested that calls be forwarded. The C subscriber may be 
fixed or mobile. 

call: connection-oriented service/event. 
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GSM Service Control Function (gsmSCF): A functional entity that contains the CAMEL service logic to implement 
OSS. It interfaces with the gsmSSF and the HLR. 

GSM Service Switching Function (gsmSSF): A functional entity that interfaces the MSC/GMSC to the gsmSCF. The 
concept of the gsmSSF is derived from the IN gsmSSF, but uses different triggering mechanisms because of the nature 
of the mobile network. 

Originating CAMEL Subscription Information (O-CSI): The O-CSI identifies the subscriber as having originating 
CAMEL services. 

Supplementary Service Notification CAMEL Subscription Information (SS-CSI): The SS-CSI identifies the 
subscriber as having supplementary service invocation notification CAMEL services. 

Terminating CAMEL Subscription Information (T-CSI): The T-CSI identifies the subscriber as having terminating 
CAMEL services. 

VMSC: The serving MSC in the VPLMN. 



3.2 



Abbreviations 



Abbreviations used in this specification are listed in GSM 01.04. 

For the purposes of this specification the following abbreviations apply: 

CAMEL Customised Applications for Mobile network Enhanced Logic 

CGI Cell Global Identifier 

FIGS Fraud Information Gathering System 

EDS Fraud Detection System 

MO Mobile Originated 

MT Mobile Terminated 

O-CSI Originating CAMEL Subscription Information 

OSS Operator Specific Services 

SS-CSI Supplementary Service Notification CAMEL Subscription Information 

T-CSI Terminating CAMEL Subscription Information 

TAP Transferred Account Procedure 



4 FIGS IVIonitoring Levels 

There are three levels of monitoring of subscriber activities using FIGS. 

Level 1 an accelerated TAP procedure associated with a mechanism such as Hot Billing is implemented in the 

MSC of the VPLMN. 

Level 2 CAMEL is used to gather information, but only at the beginning and the end of the call. 

Level 3 CAMEL provides full information on subscriber activities, as defined in 3GPP TS 42.031, i.e. call start 

and end times, and partial call records. Notification of the invocation of Explicit Call Transfer, Call 
Deflection, Call Forwarding, Call Hold and Multi Party Service is also given. 
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5 FIGS Level 1 : Accelerated TAP Records 

5.1 Method of FIGS Setting 

A PLMN shall request that a VPLMN monitor a designated subscriber using FIGS level 1 by setting a Hot Billing flag 
in the subscriber data stored in the HLR of the HPLMN. This data is drawn down by the VPLMN when the subscriber 
first registers in the VPLMN. 

If the HPLMN wishes to begin monitoring of a subscriber using FIGS Level 1 when the subscriber is already registered 
in the VPLMN, it resets the subscriber data in the VPLMN using command Insert Subscriber Data. 

5.2 Information Flows 

If a subscriber in a VPLMN is set in the subscriber categories to be monitored using FIGS Level 1 the VMSC shall 
process and return the TAP records for that subscriber in accordance with the guidelines given in current and future 
version of TAP. 



6 FIGS and CAMEL Architecture for FIGS Levels 2 

and 3 

FIGS provides the following information flows to the HPLMN, with respect to roaming subscribers monitored by FIGS 
Levels 2 and 3. 

FIGS Level 2: 

call start and end times (both MO, MT and forwarded calls). (At CAMEL Phase 1 the gsmSSF will not put a 
timestamp on messages. The arrival times of messages at the gsmSCF will be used for call start and end times.) 

FIGS Level 3: 

As for level 2 with the addition of: 

partial call information (accumulated duration of call still in progress) (CAMEL Phase only); 

notification of the invocation of ECT, CD and MPTY, CF and call hold (CAMEL Phase 2 only). 

Further phases of CAMEL will provide the functionality to check the IMEI of the ME used by a CAMEL subscriber. 
Other information required by 3GPP TS 42.031, annex A, that is not provided by CAMEL Phase 1 and CAMEL 
Phase 2, may also be provided by further phases of CAMEL. 

The architecture of the services provided by FIGS Levels 2 and 3 is given in the diagrams below. Thick lines indicate 
possible CAMEL monitoring/control relationships. 
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MO side 
HPLMN 

FIGS commands 



VPLMN 




Figure 1 : FIGS architecture for MO call 



MT side 



HPLMN 

FIGS commands 




Early 
Forwarding leg 



Figure 2: FIGS Architecture for MT/forwarded call 
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Early call forwarding can be performed if the subscriber has set Unconditional Call Forward or the HLR has 
determined, before the call is extended to VPLMN B, that the B subscriber is not reachable. In all other cases the call 
must be extended to the VMSC. 

The information flows required by FIGS levels 2 and 3 can be provided by the information flows on the CAP interfaces 
between the gsmSCF and the gsmSSF in the interrogating and visiting networks. 

The interface between the gsmSCF and the Fraud Detection System (FDS) is non-standard. 



7 FIGS Levels 2 and 3 

7.1 Method of FIGS Setting 

A PLMN shall request that a VPLMN monitor a designated subscriber using FIGS levels 2 or 3 by setting the O-CSI, T- 
CSI and SS-CSI (level 3 only) flags in the subscriber data stored in the HLR of the HPLMN. This data is drawn down 
by the VPLMN when the subscriber first registers in the VPLMN. 

If the HPLMN wishes to begin monitoring of a subscriber using FIGS Level 2 or 3 when the subscriber is already 
registered in the VPLMN, it resets the subscriber data in the VPLMN using command Insert Subscriber Data. 

7.2 Information Flows 

FIGS Levels 2 and 3 will be treated together in this section but it should be remembered that partial call records and SS 
notification invocation is not available with FIGS Level 2. 

Each item of call data required by FIGS will be considered in turn and the information flows within CAMEL which 
provide this data given. 

Text applies to the implementation of FIGS functionality using both Phases 1 and 2, unless otherwise stated. 

MO and MT calls will be treated together. If a message or DP is named as 0/T_Answer, for instance, this means that if 
the call is MO, the relevant DP is 0_answer, and that if the call is MT, the relevant DP is T_answer. 

Diagrams showing the information flows for FIGS levels 2 and 3 are given in Annex A. 

7.2.1 IVIobile Originated and Mobile Terminated Calls 
7.2.1.1 Call Start Time 

Information regarding a call attempt can be obtained from the InitialDP message sent from the gsmSSF to the gsmSCF. 
This message is sent after a control relationship for the call has been set up between the gsmSSF and gsmSCF. This 
message will provide notification to the FDS that a FIGS monitored subscriber has made a call attempt, or that an 
attempt is being made to call a FIGS monitored subscriber. 

CAMEL Phase 1 

The call, however, has not been connected at the time of the InitialDP message. The gsmSCF must therefore arm DP 
0/T_answer, so that the gsmSSF will inform the gsmSCF when the called party answers/connects. The gsmSCF arms 
the DP with message Request_Report_BCSM_Event sent to the gsmSSF. 

If the called party answers, the gsmSSF sends Event _Report_BCSM (Notify and Continue) to gsmSCF. This message 
provides notification to the FDS that the attempted call has begun. The gsmSCF must then arm DP 0/T_Disconnect, so 
that the gsmSSF will notify the gsmSCF when the call ends. 

If the called party does not answer, the gsmSSF terminates the relationship for the call with the gsmSCF. It does this 
using message 'ABORT. This message provides notification to the FDS that the call attempted did not connect. 
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CAMEL Phase 2 

The call, however, has not been connected at the time of the InitialDP message. The gsmSCF must therefore arm DP 
0/T_Answer, so that the gsmSSF will inform the gsmSCF when the called party answers/connects. The following DP"s 
(with trigger events given) must also be armed so that the gsmSCF will be informed if the trigger event occurs: 

0_Route_Select_Failure (call establishment fails, MO calls only) 

0/T_Busy (called party is busy) 

0/T_No_Answer (no answer from called party) 

0/T_Abandon (calling party abandons the call before the called party has answered) 

0/T_Not_Reachable (called party is not reachable) 

For the purposes of FIGS, these DP"s need only be armed for notification (N). 

The gsmSCF arms all these DPs with a single message Request_Report_BCSM _Event, sent to the gsmSSF. 

If the trigger event for any of O _Route_Select_Failure, 0/T_Busy, 0/T_No_Answer, 0/T_Not_Reachable occurs then 
the gsmSCF is informed by the gsmSSF of the failure of the call attempt with Event_Report_BCSM, enclosing the 
relevant cause. 

If the called party answers, the gsmSSF sends message Event_Report_BCSM to the gsmSCF. This message provides 
notification to the FDS of the start of a call by a FIGS monitored subscriber. The gsmSCF must then arm DP 
0/T_Disconnect, so that the gsmSSF will notify the gsmSCF when the call ends. 

7.2.1.2 Partial Call Records 

This functionality is available with CAMEL Phase 2 only. 

Using the 'Apply Charging' process within CAMEL Phase 2, the gsmSCF can control the duration of a call. The 
gsmSCF authorises the gsmSSF to allow the call to proceed continue for a certain time. At the conclusion of this time 
period, the gsmSSF seeks further instructions from the gsmSCF. The gsmSCF can, at this point, authorise the call to 
continue for another time period (which may be different to the first) or may instruct the gsmSSF to terminate the call. 

With regard to FIGS, this functionality can be used to generate partial call records for the gsmSCF, as follows: 

After the gsmSCF has received the InitialDP message from the gsmSSF, the gsmSCF sends message Apply jCharging 
to the gsmSSF, containing parameter 'Tcs', the 'call segment' duration. The gsmSSF will then send message 
Apply _Charging_Report to the gsmSCF after Tcs seconds. This message c 

ontains the duration of the call since the start of charging The gsmSCF may then instruct the gsmSSF to allow the call 
to continue for another Tcs seconds and this sequence of events continues until the call is released. When the call is 
released. Apply _Charging_Report is sent to the gsmSCF. 

The gsmSCF can therefore define how often it is to receive partial call records on a per subscriber, per call basis, and 
can change how often the partial call records are received during a call 

7.2.1.3 Call End Time 

When either of the calling or called parties releases the call, the 0/T-Disconnect DP is triggered and message 
Event_Report_BCSM is sent to the gsmSCF. This message provides notification to the FDS of the call end. 
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7.2.2 Forwarded Call 

7.2.2.1 Call Start Time 

The forwarded leg 'from' the called party to the forwarded-to number is considered as an MO call, originated by the 
called subscriber, as well as an MT call for the called subscriber. Two separate CAMEL dialogues will therefore be set 
up. 

The CAMEL process for the terminating leg will follow subclause 7. 1 as an MT call and the CAMEL process for the 
'originating' (forwarded) leg will follow subclause 7.1 as an MO call. 

7.2.2.2 Partial Call Records 

As for subclause 7.1.2. 

7.2.2.3 Call End Time 

As for subclause 7.1.3. 

7.2.3 Supplementary Service Invocation 

This functionality is available with CAMEL Phase 2 only. 

From CAMEL Phase 2 (GSM 03.78 Release 97), subclause 8.11: 

"At the invocation of any of the services ECT, CD and MPTY the MSC/VLR checks whether the criteria for sending a 
notification is fulfilled, i.e. whether the subscriber is provisioned with the SS-CSI and the particular invoked 
supplementary service is marked in the SS-CSI. If this is the case a notification is sent to the gsmSCF given by the 
gsmSCF address contained in the SS-CSI. The processing of the particular SS invocation is not suspended. If the 
notification criteria is not fulfilled the processing of the particular supplementary service continues unchanged and no 
notification is sent. 

The sending of the notification is independent of call related CAMEL processing, i.e. processing indicated by O/T- 
CSI." 
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Annex A (informative): 

FIGS Data provided by CAIVIEL IVIessages 

GSM 02.33 lists the information that should be present in FIGS Data messages. Tables A.l to A. 3 show the information 
required by GSM 02.33 for call start and end and partial call records, and the CAMEL messages, if any, that provide 
this information. Note that partial call records are only available with FIGS Level 3. 

The CAMEL message given for a particular call event, e.g. call end, will not necessarily arrive at that event. The FDS 
must have the ability to build up a full picture of a call as various CAMEL messages are received. 

Table A.1 : Required Call Start information 



Information 


MO 


MX 


CF 


Dialled digits 


InitialDP (IDP), Called 
Party BCD Number 


IDP, Called Party Number 


IDP, Called Party 
Number 


A party number 


IDP, Calling Party Number 


IDP, Calling Party Number, 
if available 


IDP, Calling Party 
Number, if available 


B party number 


IDP, Called Party BCD 

Number 


IDP, Called Party Number 


IDP, Called Party 
Number 


Modified B party 
number 


gsmSCF 


gsmSCF 


gsmSCF 


C party number 


n/a 


n/a 


Called Party Number 


Modified C party 
number 


gsmSCF 


gsmSCF 


gsmSCF 


CGI (of A party) 


IDP, Location Number 


location number in ISUP 
signalling, if available 


location number in ISUP 
signalling, if available 


IMSI 


IDP, IMSI (of Aparty) 


/DP, /M5/ (of B party) 


/DP, /M5/ (of B party) 


IMEI(of Aparty) 


Not available 


Not available 


Not available 


Call Start Time/Date 


Phase 1: arrival time of 
Event_Report_BCSM 

Phase 2: Timestamp on 
Event_Report_BCSM 


Phase 1 : arrival time of 
Event_Report_BCSM 

Phase 2: Timestamp on 
Event_Report_BCSM 


Phase 1 : arrival time of 
Event_Report_BCSM 

Phase 2: Timestamp on 
Event_Report_BCSM 


Call Reference 


IDP, Call 
Reference _Number 


IDP, Call 
Reference_Number 


IDP, Call 
Reference _Number 


MO/MT indicator 


IDP, Event Type BCSM 


IDP, Event Type BCSM 


IDP, Event Type BCSM 


Visited MSC address 


IDP, MSC Address 


IDP, MSC Address 


IDP, MSC Address 


Type of service 


IDP, Basic Service Code, if 
available 


IDP, Basic Service Code, if 
available 


IDP, Basic Service Code, 
if available 



Dialed digits: This always gives (for MO calls) the number originally entered by the party making the call, including 
any non-numeric characters. 

Modified B/C party number: As the number is modified by the gsmSCF itself, it is assumed that the FDS will have 
direct access to this field and need not scan outgoing messages from the gsmSCF to obtain the field. If, however, the 
FDS must scan outgoing messages, the field is given in field Destination Routing Address in message Connect. 

Cell Global Identifier (CGI): refers to the cell used by the MS at the start of the call. 
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Table A.2: Required Call End information 



Information 


MO 


MX 


CF 


A party number 


IDP, Calling Party Number 


IDP, Calling Party Number, 
if available 


IDP, Calling Party 
Number, if available 


B party number 


IDP, Called Party BCD 

Number 


IDP, Called Party Number 


IDP, Called Party 
Number 


Modified B party 
number 


gsmSCF 


gsmSCF 


gsmSCF 


CGI 


IDP, Location Number 


location number in ISUP 
signalHng, if available 


location number in ISUP 
signalling, if available 


IMSI 


IDP, IMSI (of A party) 


/DP, /M5/ (of B party) 


/DP, /M5/ (of B party) 


IMEI 


Not available 


Not available 


Not available 


Call Duration/end 


Phase 1 : Arrival time, Phase 

2: Timestamp, of 

Event_Report_BCSM (with 

Event_Type_BCSM = 

0/T_Disconnect) 


Phase 1 : Arrival time. Phase 
2: Timestamp, of 

Event_Report_BCSM (with 

Event_Type_BCSM = 

0/T_Disconnect) 


Phase 1 : Arrival time. 

Phase 2: Timestamp, of 

Event_Report_BCSM 

(with Event_Type_BCSM 

= 0/T_Disconnect) 


Call Reference 


IDP, Call 
Reference _Number 


IDP, Call 
Reference_Number 


IDP, Call 
Reference _Number 


MO/MT indicator 


IDP, Event Type BCSM 


IDP, Event Type BCSM 


IDP, Event Type BCSM 



CGI. If available, the CGI of the cell used by the MS at the end of the call is used. If this is not available, the CGI of 
the cell used at the start of the call is given. 
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Table A.3: Required Partial Call Information (CAIVIEL Phase 2 only) 



Information 


MO 


MX 


CF 


Dialled digits 


InitialDP (IDP), Called 
Party BCD Number 


IDP, Called Party Number 


IDP, Called Party 
Number 


A party number 


IDP, Calling Party Number 


IDP, Calling Party Number, 
if available 


IDP, Calling Party 
Number, if available 


B party number 


IDP, Called Party BCD 

Number 


IDP, Called Party Number 


IDP, Called Party 
Number 


Modified B party 
number 


gsmSCF 


gsmSCF 


gsmSCF 


C party number 


n/a 


n/a 


Called Party Number 


Modified C party 
number 


gsmSCF 


gsmSCF 


gsmSCF 


CGI 


IDP, Location Number 


location number in ISUP 
signalling, if available 


location number in ISUP 
signalling, if available 


IMSI 


IDP, IMSI (of A party) 


/DP, /M5/ (of B party) 


/DP, /M5/ (of B party) 


IMEI 


Not available 


Not available 


Not available 


Call Start Time/Date 


Phase 1: arrival time of 
Event_Report_BCSM 

Phase 2: Timestamp on 
Event_Report_BCSM 


Phase 1 : arrival time of 
Event_Report_BCSM 

Phase 2: Timestamp on 
Event_Report_BCSM 


Phase 1 : arrival time of 
Event_Report_BCSM 

Phase 2: Timestamp on 
Event_Report_BCSM 


Call Duration 


App ly_Cha rging_Repo rt. 

Time Since Start of 

Charging 


Apply _Charging_Report, 

Time Since Start of 

Charging 


App ly_Cha rging_Repo rt. 

Time Since Start of 

Charging 


Call Reference 


IDP, Call 
Reference _Number 


IDP, Call 
Reference_Number 


IDP, Call 
Reference _Number 


MO/MT indicator 


IDP, Event Type BCSM 


IDP, Event Type BCSM 


IDP, Event Type BCSM 


Visited MSC address 


IDP, MSC Address 


IDP, MSC Address 


IDP, MSC Address 


Type of service 


IDP, Basic Service Code, if 
available 


IDP, Basic Service Code, if 
available 


IDP, Basic Service Code, 
if available 



The CAMEL message for SS invocation notification have not yet been defined so the call information for SS invocation 
notification can only be specified in general terms. 

The notification of supplementary service (SS) invocation will be the same as table A.3, except that information field 
'Type of Service' will be 'Type of SS', and 'Call Duration' will be 'Time of SS invocation'. 'Type of SS' will be given in 
the invocation notification sent from the gsmSSF to the gsmSCF. 'Time of SS invocation' will be the timestamp in the 
invocation notification or its time of arrival at the gsmSCF. 
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Annex B (informative): 

Information Flow for FIGS Levels 2 and 3 



VPLMN 

MSC 



EDP-N 



EDP-N 



Messages 

For each call attempt : 

Initial DP 
> 

Request Report BCSM Event 
< 

Continue 
< 

+ For each successful call : 

Event Report BCSM 
> 

+ For each unsuccessful call : 

Event Report BCSM 



HPLMN 

gsmSCF 



Comments 



Request for instructions from the SCP 



To be aware of the call end 



To continue the call 



To notify the SCP that the call has ended 



Event report on « Busy », « no answer », etc. 



Figure B.1 : Message flow for a subscriber monitored using FIGS Level 2 
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VPLMN 

MSC 



EDP-N 



EDP-N 
EDP-R 



EDP-N 



Messages 

For each call attempt : 
Initial DP 

^ 

Apply Charging 

Request Report BCSM Event 

Continue 



+ For each successful call : 

Event Report BCSM 

( < Release ) 



HPLMN 

SCP 



Comments 



Apply Charging Report 
> 

Event Report BCSM 
> 

Continue / Release 
< 

+ For each unsuccessful call : 

Event Report BCSM 



Request for instructions from the SCP 

To control the call duration 

To be aware of the call answer &the call end 

To continue the call without change of the 
data by the SCP 



To notify the SCP that the call has been 
answered by the remote party 



This message is sent during the call only if the 
call must be released by the SCP because of a 
fraudulent situation 



End of the call : 

To provide the SCP with the elapsed time 

since the start of charging 

To notify the SCP that the call has ended 



Release is sent to stop the call at the end 



Event report on « Busy », « no answer », etc. 



Figure B.2: Message flow for a subscriber monitored using FIGS Level 3 
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Annex C (informative): 
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